603322 - new[] mismatch with delete instead of delete[] in TVariable::shareConstPointer

Status: RESOLVED FIXED

(Core :: Graphics, defect)

Description

[timeless]

Note: mismatched allocators can result in heap corruption. This isn't just a crash, it's actually *bad*.

71 class TVariable : public TSymbol {
72 public:
85     ConstantUnion* getConstPointer()
87         if (!unionArray)
88             unionArray = new ConstantUnion[type.getObjectSize()];
90         return unionArray;

93     ConstantUnion* getConstPointer() const { return unionArray; }

95     void shareConstPointer( ConstantUnion *constArray)
97         delete unionArray;
98         unionArray = constArray;  

944 bool TParseContext::executeInitializer(TSourceLoc line, TString& identifier, TPublicType& pType, 
980     if (qualifier == EvqConst) {
992         if (initializer->getAsConstantUnion()) { 
993             ConstantUnion* unionArray = variable->getConstPointer();
994 
995             if (type.getObjectSize() == 1 && type.getBasicType() != EbtStruct) {
997             } else {
998                 variable->shareConstPointer(initializer->getAsConstantUnion()->getUnionArrayPointer());

Comment 1

[timeless]

Attachment: match allocator

Comment 2

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Needs to be filed at http://code.google.com/p/angleproject/ -- please file further ANGLE bugs there.

Comment 3

[timeless]

fixed with the landing of bug 616290